The EU AI Act and a student residence's WhatsApp assistant in Spain: what Article 50 requires from August 2026
From 2 August 2026, anyone who writes to a student residence's WhatsApp number and gets an answer from an AI assistant must know, unless it is obvious, that they are not talking to a person. Article 50 of the EU AI Act requires it, and the duty falls first on whoever builds the assistant, not on the centre that uses it. Here is what falls to each, with the articles in front of you.
The short answer
Regulation (EU) 2024/1689 splits the obligations between whoever develops the system and whoever uses it. For an assistant that answers residents on WhatsApp, the split looks like this:
| Question | Answer | Where it says so |
|---|---|---|
| Must people be told that an AI is answering? | Yes, unless it is obvious. Clearly and distinguishably, at the latest at the first interaction. | Art. 50(1) and 50(5) |
| Who does that duty fall on? | The provider, who has to design the system so that it informs. The residence is the deployer. | Arts. 3(3), 3(4) and 50(1) |
| Is it a high-risk system? | No, as long as it is used to attend to residents. That changes if it decides or scores admissions. | Art. 6(2), Art. 6(3) and Annex III |
| What falls to the residence in any case? | Taking measures that support its staff's AI literacy. Since 27 July 2026 the rule does not require any particular level to be ensured. | Art. 4, as worded in 2026 |
| When does Art. 50 apply from? | From 2 August 2026. Marking generated content (Art. 50(2)) has a deadline of 2 December 2026 if the system was already on the market. | Arts. 113 and 111(4) |
| Are there fines set in Spain? | The Regulation sets ceilings, but each Member State has to adopt the penalty regime, and Spain has not adopted it. | Art. 99(1) and 99(4)(g) |
Source: Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744; official copies of the Official Journal of the EU published in the BOE, Spain's official gazette.
Worth knowing
The AI Act was amended in July 2026. Regulation (EU) 2026/1744, known as the "Digital Omnibus on AI", of 8 July 2026, was published in the Official Journal of the EU on 24 July and has been in force since 27 July. On the matters this guide covers it changes three things: Art. 4 no longer asks for a sufficient level of AI literacy to be ensured, but for measures that support it; the obligations for high-risk systems are postponed to 2 December 2027 or 2 August 2028; and a provider whose system was already on the market before 2 August 2026 has until 2 December 2026 to mark the content it generates (Art. 50(2)).
The notice that one is talking to an AI (Art. 50(1)) does not change. This guide quotes the text currently in force.
Provider and deployer: who is who
The whole Regulation rests on two roles. The provider is whoever develops an AI system — or has it developed — and places it on the market or puts it into service under its own name or trademark, whether it charges for it or not (Art. 3(3)). In the typical case, the company that sells the AI assistant.
"[…] using an AI system under its authority, except where the AI system is used in the course of a personal non-professional activity"
The student residence, the colegio mayor (a Spanish hall of residence with a formative programme) or the coliving that hires that assistant and sets it to answer its residents is the deployer. It does not write the code or train the model, but it decides to use it, with what information and for what.
Worth knowing
What gets taken for granted: that a centre is always just "the one using it". The definition of provider also covers anyone for whom a system is developed and who puts it into service under its own name or trademark. A centre that commissions a bespoke assistant and launches it as its own may be the provider. The contract should say who is who.
What Article 50 requires, and of whom
It is the obligation that applies squarely to an assistant that answers residents, what is known as AI transparency. Art. 50(1) says:
"Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use."
The subject is the provider and the verb is "designed and developed". The residence does not have to write the notice or paste it in by hand: the assistant has to come built to give it. What the residence should do is check that it does.
Art. 50(5) adds how: the information shall be provided "in a clear and distinguishable manner at the latest at the time of the first interaction or exposure", and it "shall conform to the applicable accessibility requirements". The rule does not require repeating it in every message.
The "obvious" exception
The notice is not needed when it is obvious that one is talking to an AI. Recital 132 measures this from the standpoint of a person who is "reasonably well-informed, observant and circumspect" and asks for attention to "vulnerable groups due to their age or disability". It does not define what is obvious.
In a residence it is an exception best not relied upon. The resident writes to the reception number, the same one a member of staff used to answer, and at eleven at night has no reason to assume there is a machine on the other side.
What does fall to the residence
AI literacy under Art. 4
Art. 4, as worded by Regulation (EU) 2026/1744, requires providers and deployers to take "measures to support the promotion of AI literacy" among their staff and the other people who operate the system on their behalf, taking into account their technical knowledge, experience, education and training, the context of use and the people on whom it is to be used. And it specifies that the duty "does not require providers or deployers to ensure a specific level of AI literacy of any particular person".
That is not what the 2024 text said, applicable since 2 February 2025: it asked for measures to ensure that staff had "a sufficient level of AI literacy". Recital 8 of the 2026 Regulation explains the change: a strict obligation did not suit every provider and deployer and weighed above all on small businesses. In return, the Commission and the Member States have to support those efforts, and the Commission will publish practical examples of how to comply (Art. 4(2)). The glossary entry on AI literacy sums it up.
The rule sets no hours, syllabus or certificate. A reasonable reading for a residence: reception and management should know what the assistant answers, when it passes a matter to a person, how a mistake gets corrected and what data it sees.
Published text, only if it is of public interest
The second paragraph of Art. 50(4) requires the deployer to disclose that a text has been generated or manipulated by AI when that text "is published with the purpose of informing the public on matters of public interest". A private WhatsApp answer to a resident is not that. And the duty falls away if the text has undergone human review or editorial control and someone holds editorial responsibility for it.
The rule does not define "public interest". An internal notice about dining-hall hours hardly qualifies; a note on the centre's website about a general matter deserves a human review before it goes out.
What does not fall to it is marking the text. Art. 50(2) requires outputs, text included, to be "marked in a machine-readable format", but that is a technical obligation of the provider (Recital 133). If its system was already on the market before 2 August 2026, it has until 2 December 2026 to comply (Art. 111(4), added by Regulation (EU) 2026/1744).
The same 2026 Regulation replaced Art. 50(7): the Commission will encourage codes of practice on detecting, marking and labelling AI-generated content and will assess whether following them is adequate to meet paragraphs 2 and 4. If a code is not, it may lay down common rules by means of an implementing act.
Why it is not a high-risk system
High-risk systems, which carry the Regulation's heaviest obligations, are those in Annex III (Art. 6(2)), plus certain safety components of regulated products (Art. 6(1)). The two points of the annex that come closest to a residence say this:
- Education and vocational training (point 3): systems that determine access or admission to educational institutions, that evaluate learning outcomes or the level of education, and that monitor prohibited behaviour during tests.
- Essential services (point 5): public assistance benefits assessed by public authorities, creditworthiness, life and health insurance, and emergency calls and triage.
Student accommodation does not appear. An assistant that says when the dining hall closes, opens a maintenance report or tells someone a parcel has arrived fits none of the points. It is not high-risk.
Worth knowing
What gets taken for granted: that because it is a chatbot it will never be high-risk. What decides is the task, not the format. If the tool starts deciding or scoring who gets a place, it moves towards point 3(a) of Annex III, and Art. 6(3) says Annex III systems that perform profiling of natural persons are always considered high-risk.
The annex does not say whether a residence counts as an educational institution for these purposes. If AI enters admissions, the whole system has to be assessed again.
The obligations of a high-risk system also have their own timetable. Regulation (EU) 2026/1744 postponed those in Chapter III, Sections 1 to 3: they apply from 2 December 2027 to systems under Art. 6(2) and Annex III, and from 2 August 2028 to those under Art. 6(1) and Annex I (Art. 113(c)).
Fines: what the Regulation sets and what is missing in Spain
Art. 99(4)(g) penalises breaches of "the transparency obligations […] pursuant to Article 50", by providers and by deployers, with administrative fines of "up to EUR 15 000 000 or, if the offender is an undertaking, up to 3 % of its total worldwide annual turnover for the preceding financial year, whichever is higher". For SMEs, Art. 99(6) flips the rule: the amount or the percentage applies, "whichever thereof is lower".
These are maximum ceilings, and the decisive piece is left to each country: Art. 99(1) tasks Member States with laying down the penalty regime. AI literacy under Art. 4 is not on the list in Art. 99(4); what consequence breaching it has depends on that national regime.
Spain, as of 19 October 2026
The draft organic law on the good use and governance of AI (file 121/000096), introduced on 28 May 2026, is listed on the website of the Congress of Deputies as "Concluido - (Caducado)" — concluded, lapsed — since 6 October 2026, because of Royal Decree 806/2026 of 5 October, which dissolved the Spanish Parliament. So no national penalty regime has been adopted.
The Regulation does not need a Spanish law to apply: it is directly applicable in every Member State (Art. 113). And the authority exists: AESIA, the Spanish Agency for the Supervision of Artificial Intelligence, based in A Coruña, which its Statute (Royal Decree 729/2023, Arts. 1, 2 and 4) entrusts with the supervision and, where appropriate, the sanctioning of AI systems at state level.
Worth knowing
No Spanish law does not mean Art. 50 does not bind. It binds from 2 August 2026; what is missing is the national instrument saying how it is penalised, and nobody knows when it will arrive.
What to ask the provider before signing
None needs a lawyer, and the answers say a lot about who is on the other side:
- How and when does the assistant say it is an AI? It should be visible in the first conversation from a number that has never written before (Art. 50(1) and 50(5)).
- Is the notice understood? If residents write in several languages, a notice in only one is hardly "clear" to all of them.
- What does it do when it does not know something or the matter is sensitive? Art. 50 does not require it, but it defines the real risk: who the conversation passes to and how fast. That is escalation to a person.
- How does it meet the marking duty in Art. 50(2)? Anyone providing a system that generates text should have an answer. If the system was already on the market before 2 August 2026, the deadline is 2 December 2026 (Art. 111(4)).
- Does the system take part in admissions or build profiles? If so, a different chapter applies (Art. 6(3) and Annex III).
- What does it offer for AI literacy under Art. 4? Material or sessions so the team knows what the assistant does and where its limits are.
- Who is who in data protection? A different law, but it gets asked in the same meeting. It is explained in the GDPR guide for residences.
What the Regulation does not say
- It sets no wording or frequency for the notice. It asks for it to be "clear and distinguishable" and to arrive "at the latest" at the first interaction.
- It does not define "obvious". It describes the reference person and asks for attention to age and disability (Recital 132).
- It does not mention residences, colegios mayores or student accommodation in Annex III.
Frequently asked questions
Do we have to tell residents that the WhatsApp line is answered by an AI?
From 2 August 2026 they must be informed, unless it is obvious. But the duty in Art. 50(1) of Regulation (EU) 2024/1689 belongs to the provider: the assistant has to be designed to give the notice. The residence should check that it does so clearly and distinguishably, at the latest at the first interaction, as Art. 50(5) requires. The rule does not require repeating the notice in every message, nor does it set any particular wording.
Is a student residence's AI assistant a high-risk system?
No, as long as it is used to attend to residents. High-risk systems are those in Annex III of the Regulation (Art. 6(2)), and in education the list is limited to admissions, evaluation of learning, level of education and monitoring of tests. Student accommodation does not appear. That changes if the tool starts deciding or scoring who gets a place: Art. 6(3) treats Annex III systems that profile natural persons as always high-risk. Since the July 2026 amendment, the high-risk obligations for Annex III systems apply from 2 December 2027.
What fine applies if the assistant does not say it is an AI?
Art. 99(4)(g) of the Regulation sets, for Art. 50, fines of up to 15 million euros or, if the offender is an undertaking, up to 3 % of its total worldwide annual turnover for the preceding year, whichever is higher. For SMEs the lower applies (Art. 99(6)). But the actual regime is set by each Member State (Art. 99(1)), and in Spain the bill that was to do so lapsed on 6 October 2026 when Parliament was dissolved.
Do we have to train our staff in artificial intelligence?
You have to do something, but not reach a particular level. Since 27 July 2026, Art. 4, as worded by Regulation (EU) 2026/1744, also requires deployers to take measures to support their staff's AI literacy, taking into account their knowledge, experience, training and the context of use, and it makes clear that it does not require a specific level to be ensured for anyone. Before, it asked for a sufficient level. The rule sets no hours, syllabus or certificate. In a residence, the practical version is that reception and management know what the assistant answers, when it passes a matter to a person and how a mistake gets corrected.
Do we have to say that a notice to residents was written by an AI?
Only in one case. Art. 50(4) requires the deployer to disclose it when the text is published to inform the public on matters of public interest, and even then it does not apply if a person has reviewed it and someone holds editorial responsibility. A private WhatsApp answer does not fall within that case, and an internal notice from the centre hardly does. The rule does not define public interest.
Who supervises compliance with the AI Act in Spain?
There is AESIA, the Spanish Agency for the Supervision of Artificial Intelligence, a public-law entity based in A Coruña whose Statute was approved by Royal Decree 729/2023 and which is entrusted with supervising and, where appropriate, sanctioning AI systems at state level. What does not exist as of 19 October 2026 is the law setting the national penalty regime required by Art. 99(1): the bill lapsed when the Spanish Parliament was dissolved.